Enhancements for Authentication Using Smart Cards

Where Can I Use This?	What Do I Need?
GlobalProtect Subacription License	GlobalProtect app version 6.3.0 or later GlobalProtect app running on Windows endpoints

If you have configured Connect Before Logon-

On-demand

mode for the GlobalProtect app with smart card authentication as the authentication method, the app now provides the flexibility to the end users to authenticate to the app either using smart card or using their username/password. With this feature enabled, the GlobalProtect app displays two authentication profiles for the enduser in the

Portals

drop-down on the app homepage; a profile with

<PIV>

and another profile with

<NO PIV>

. From the two available options, the end users can choose their preferred authentication profile. The profile with

PIV

option allows the end user to authenticate to the app using the smart card authentication method whereas the profile with

NO PIV

option allows them to authenticate to the app using their username and password.

For example, if end users forget to bring their smart card to work, they can choose the authentication profile with

NO PIV

from the

Portals

drop-down and can use their username and password to authenticate to the app. If smart card is available, they can use the profile with

PIV

and authenticate using smart card authentication.

This feature will work only when ActivClient software is installed on the device.

For the GlobalProtect app to display the authentication profile options with or without the PIV smart card, you must:

Ensure that Connect Before Logon (CBL) is configured with

On-demand

mode for the GlobalProtect app.

Select the Allow Authentication with User Credentials OR Client Certificate option while configuring the GlobalProtect gateway and portal. This option defines whether users can authenticate to the portal or gateway using credentials and/or client certificates.

In the Windows Registry, define the predeployment settings for the app to display the authentication profile options with

PIV

and

No PIV

.

Launch the Command Prompt and enter
regedit
to open the Windows Registry.
In the Windows Registry, go to:
HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\
.
Click
Edit
and then select
New
String Value
.
When prompted, specify the
Name
of the new registry value as
PIV-profile
.
Right-click the new registry value and
Modify
it.
Set the
Value Data
to
yes
Click
OK
.

To predeploy the setting from Windows Installer (Msiexec) use the following syntax:

msiexec.exe / globalprotect64.msi /i PIVPROFILE=yes